CVE-2026-89209

A vulnerability has been identified in Mendix SAML Mendix 10 compatible All versions V4.2.4, Mendix SAML Mendix 11 compatible All versions V4.2.4, Mendix SAML Mendix 9 compatible All versions V3.6.29. Affected versions of the module do not properly protect against SAML assertion replay in...

CVE-2026-89209

The Mendix SAML module is vulnerable to SAML assertion replay in IdP-initiated authentication flows. This flaw affects Mendix 10 compatible versions prior to V4.2.4 , Mendix 11 compatible versions prior to V4.2.4 , and Mendix 9 compatible versions prior to V3.6.29 . An unauthenticated remote atta...

CVE-2026-89209

A vulnerability has been identified in Mendix SAML Mendix 10 compatible All versions V4.2.4, Mendix SAML Mendix 11 compatible All versions V4.2.4, Mendix SAML Mendix 9 compatible All versions V3.6.29. Affected versions of the module do not properly protect against SAML assertion replay in...

EUVD-2026-109739

A vulnerability has been identified in Mendix SAML Mendix 10 compatible All versions V4.2.4, Mendix SAML Mendix 11 compatible All versions V4.2.4, Mendix SAML Mendix 9 compatible All versions V3.6.29. Affected versions of the module do not properly protect against SAML assertion replay in...

CVE-2026-89209

A vulnerability has been identified in Mendix SAML Mendix 10 compatible All versions V4.2.4, Mendix SAML Mendix 11 compatible All versions V4.2.4, Mendix SAML Mendix 9 compatible All versions V3.6.29. Affected versions of the module do not properly protect against SAML assertion replay in...

PT-2026-123279

Name of the Vulnerable Software and Affected Versions Mendix SAML Mendix 10 compatible versions prior to 4.2.4 Mendix SAML Mendix 11 compatible versions prior to 4.2.4 Mendix SAML Mendix 9 compatible versions prior to 3.6.29 Description The module fails to properly protect against SAML assertion...

Siemens Mendix SAML Module

SUMMARY Mendix SAML module contains an authentication bypass vulnerability that could allow an unauthenticated remote attacker to gain unauthorized access by replaying a valid SAML assertion in IdP-initiated authentication flows. Siemens has released new versions for the affected products and...

CVE-2026-116201

Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs handler. Attackers can send concurrent POST requests to /saml/acs with one captured assertion to obtain multiple...

CVE-2026-116201

The software Snipe-IT versions before 8.5.0 is vulnerable to a SAML assertion replay vulnerability. The root cause is a non-atomic nonce check within the SAML acs handler , which creates a race condition . By sending concurrent POST requests to /saml/acs using a single captured assertion, an atta...

CVE-2026-116201 Snipe-IT before 8.5.0 SAML Assertion Replay via Race Condition

Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs handler. Attackers can send concurrent POST requests to /saml/acs with one captured assertion to obtain multiple...

CVE-2026-116201 Snipe-IT before 8.5.0 SAML Assertion Replay via Race Condition

Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs handler. Attackers can send concurrent POST requests to /saml/acs with one captured assertion to obtain multiple...

EUVD-2026-109459

Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs handler. Attackers can send concurrent POST requests to /saml/acs with one captured assertion to obtain multiple...

PT-2026-123042

Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs handler. Attackers can send concurrent POST requests to /saml/acs with one captured assertion to obtain multiple...

PT-2026-89251

Name of the Vulnerable Software and Affected Versions Drupal SAML SSO - Service Provider versions 0.0.0 through 3.2.0 Description An authentication bypass issue exists where the module does not sufficiently prevent the reuse of previously accepted SAML assertions. This allows a valid assertion to...

CVE-2026-12704

On Grafana Enterprise instances with the optional IdP-initiated SAML single sign-on enabled allowidpinitiated = true, disabled by default, Grafana did not fully validate the InResponseTo field of SAML responses. An attacker who obtained a valid, signed SAML assertion for a user could replay it...

CVE-2026-75034 Rancher: SAML Assertion Replay

A flaw was found in Rancher Manager. The SAML assertion replay protection introduced by the fix for CVE-2026-44946 recorded consumed assertion IDs in a per-process cache, so each replica only detected replays that reached the same pod. In a high-availability deployment, an attacker holding a...

PT-2026-83115

Name of the Vulnerable Software and Affected Versions Rancher versions prior to 2.15.1 Description Rancher Manager contains a flaw in its SAML assertion replay protection. Consumed assertion IDs are recorded in a per-process cache, meaning each replica only detects replays that reach the same pod...

CVE-2026-53424 Missing one-time-use enforcement in Samly allows replay of SAML bearer assertions

Authentication Bypass by Capture-replay vulnerability in dropbox samly allows an attacker to authenticate as the subject of a captured SAML assertion by resubmitting it. Samly.Helper.decodeidpauthresp/3 in lib/samly/helper.ex calls esamlsp:validateassertion/2, whose default duplicate detector is ...

EEF-CVE-2026-53424 Missing one-time-use enforcement in Samly allows replay of SAML bearer assertions

Summary Authentication Bypass by Capture-replay vulnerability in dropbox samly allows an attacker to authenticate as the subject of a captured SAML assertion by resubmitting it. Samly.Helper.decodeidpauthresp/3 in lib/samly/helper.ex calls esamlsp:validateassertion/2, whose default duplicate...

PT-2026-79072

Name of the Vulnerable Software and Affected Versions dropbox samly versions 0.3.0 and later Description An authentication bypass exists where an attacker can authenticate as the subject of a captured SAML assertion by resubmitting it. This occurs because the function decode idp auth resp/3 in...